New Regulatory Standards for the Custody of Cryptobased Assets: FINMA Guidance 01/2026

Key Risks in Crypto Custody

FINMA highlights several risks inherent to the custody of cryptobased assets, including:

• Operational risks: Assets stored on the blockchain are exposed to cyberattacks and the risk of inadequate private key protection.
• Counterparty risks: When custody is delegated to third parties, especially those abroad, there is a risk that assets may not be segregated in the event of insolvency.
• Legal complexity: Cross-border custody arrangements can introduce complex legal issues, particularly regarding bankruptcy protection and the enforceability of segregation.
• Supervisory gaps: The risk increases if third-party custodians are not subject to prudential supervision or equivalent regulatory standards.

Regulatory Requirements

1. Custody by Swiss Banks

The DLT blanket act introduced comprehensive bankruptcy protection for cryptobased assets held in custody by third parties. Properly segregated client crypto assets, ie. assets held in readiness for customers at all times and either being in individual custody or collective custody with clearly allocated customer shares, do not form part of the custodian’s bankruptcy estate.

Swiss banks may offer custody and trading of cryptobased assets within a bankruptcy-proof framework. If a Swiss bank holds cryptobased assets as segregable custody assets, it is generally treated as off-balance sheet and therefore also exempt from capital requirements for these assets. This exemption also applies if custody is delegated to third parties abroad, provided that the foreign custodian is subject to equivalent prudential supervision and that foreign law provides bankruptcy protection for cryptobased assets.

2. Individual Portfolio Management

Institutions engaging in individual portfolio management must ensure that cryptobased assets are held with prudentially supervised entities (banks, securities firms, DLT trading facilities, or foreign institutions subject to supervision equivalent to that in Switzerland) which have an adequate technical infrastructure and the necessary expertise. Assets must be segregated per client and securely stored, with bankruptcy protection guaranteed. If assets are held abroad, it must be ensured that the custodian institution is subject to supervision equivalent to that in Switzerland, and foreign law must provide equivalent bankruptcy protection for the cryptobased assets.

Existing custody arrangements with (a) foreign custodians that are subject to equivalent prudential supervision but where no equivalent bankruptcy protection exists or (b) Swiss custodians under self-regulatory organisation (SRO) supervision in which bankruptcy protection is ensured but prudential supervision is lacking, may be permissible if:

• clients are comprehensively informed of increased custody risks, in particular in the event of bankruptcy;
• clients are informed about alternative suitable custodians in Switzerland or abroad; and
• written client consent is documented.

The guarantee of appropriate safekeeping of entrusted assets may not be circumvented by structures with foreign products. It remains the responsibility of the institutions to ensure appropriate custody of cryptobased client assets. Custody arrangements that do not meet the regulatory requirements must be adjusted in the interests of client protection.

3. Management of Collective Assets

Fund assets (including cryptobased assets) of Swiss collective investment schemes must be held with a Swiss custodian bank. Delegation by the custodian bank to third-party custodians or central securities depositories in Switzerland or abroad is allowed if the custodian is subject to equivalent prudential supervision and if bankruptcy protection exists. The risks associated with such transfers must be disclosed to investors in the prospectus and basic information sheet as required by the Financial Services Act.

4. Offering Structured Products or Crypto ETPs

The issuing of structured products to retail clients by special purpose entities is permitted if these products are offered by prudentially supervised institutions, with legally enforceable guarantees or real security provided for the issuer’s obligations. FINMA highlights custody risks for underlying cryptobased assets pledged as security, requiring legal protection in the event of custodian bankruptcy. Swiss stock exchanges have already issued specific rules for the listing and collateralization of crypto ETPs, ensuring investor protection.

Practical Implications for Swiss Institutions

• Due diligence: Institutions must carefully select custodians for outsourcing and sub-custody arrangements, ensuring compliance with prudential supervision and bankruptcy protection requirements.
• Client communication: Where exceptions exist, institutions must provide comprehensive risk disclosures, inform about alternative suitable custodians, and obtain written client consent.
• Ongoing review: Custody arrangements must be regularly reviewed and adjusted to meet evolving regulatory requirements and ensure robust client protection.
• Record-keeping: Institutions must maintain clear documentation of custody arrangements, client communications, and compliance with regulatory standards.

Outlook

The new FINMA guidance underscores the importance of robust risk management, technical expertise, and careful selection of third parties where custody of cryptobased assets is outsourced. Secure custody requires not only appropriately supervised service providers but also clear and enforceable rules that protect client assets in the event of a custodian’s bankruptcy. Importantly, FINMA emphasises that responsibility remains with the authorised Swiss financial institution, even when custody is outsourced to third parties. Institutions should therefore conduct a careful selection of third-party custodians and implement robust contractual arrangements. Where custody is outsourced abroad, institutions must additionally anticipate complex conflict‑of‑laws questions and heightened insolvency risks.